For worse, I would say. This kind of thing is about accountability shuffling and not at all about improving security.

I'm concerned that you're not familiar with EDR and organizations who flat out can't build a full 24/7 SOC. Which is the vast majority of businesses.

EDR is a rootkit based on the idea that malware hashes are useless, and security needs to get complete insight into systems after a compromise. You can't root out an attacker with persistence without software that's as invasive as the malware can get.

And a managed SOC is shifting accountability to an extent because they are often _far_ cheaper than the staff it takes to have a 24/7 SOC. That's assuming you have the talent to build a SOC instead of paying for a failed SOC build. Also, don't forget that you need backup staff for sick leave and vacation. And you'll have to be constantly hiring due to SOC burnout.

If all of this sounds like expensive band-aids instead of dealing with the underlying infection, it is. It's complex solutions to deal with complex attackers going after incredibly complex systems. But I haven't really heard of security solutions that reduce complexity and solve the deep underlying problems.

Not even theoretical solutions.

Other than "unplug it all".

> This kind of thing is about *accountability shuffling* and not at all about improving security.

You nailed it. Can't really blame CISOs for pursuing this model though.

It would be a shame if justice ever found itself obstructed by "accountability shuffling".

Huh? Small and medium sized businesses have how much to spend on security? Let alone IT?